Enterprise buying guide

How to Buy Cloudflare Enterprise: Pricing, Contract Terms and Evaluation

Short answer: Cloudflare Enterprise has no public price list. A quote is built from five variables: number of domains, traffic and request volume, the product mix you need, the service commitment level, and contract length — annual contracts are the norm. Once those are clear, send them to us and we will assess your actual architecture, including which capabilities are mandatory and which can wait.

Why there is no public price list

Self-serve tiers can be priced openly because the capability set is fixed: pick a tier, get a defined list of features and quotas. Enterprise is sold differently — it behaves like a contract drawn up against your architecture, where the capability mix, quota ceilings, service commitments and support model are each confirmed individually.

Two practical consequences follow. First, a number someone else was quoted tells you little, because the capability mix behind it is probably different. Second, "tell me the price and I will decide whether to talk" does not work; the reverse is more useful — clarify the requirement first, and the price becomes comparable.

What the quote is built from

Variable	How it moves the quote	What to prepare
Number of domains and subdomains	Contracts are usually priced per domain or per domain band; more sites and more complex structures mean a larger scope	Your primary domain, business subdomains, and domains planned for the next year
Traffic and request volume	Monthly requests, egress bandwidth and peak values set the usage band; video and large-file delivery move it separately	Monthly requests and egress bandwidth for the last 3–6 months, including peaks
Product mix	WAF, bot management, API security, DDoS mitigation, Zero Trust seats and edge compute are counted per module	A prioritised capability list marking what is mandatory and what is optional
Service commitment and support	Uptime target, response times, dedicated technical contacts and escalation paths — different levels carry different commercial terms	The minimum uptime and incident response you can accept
Contract length and payment	Annual contracts are the norm; longer terms usually come with better commercial conditions	Your budget cycle and target signature and start dates
Region and compliance	Serving specific markets (mainland China, for example) adds a compliance and licensing path	Your target markets and whether you already hold the required qualifications

This list is the input to the assessment itself: the more specific the information, the closer the quote lands to the final contract — and the fewer changes come later.

What the contract normally contains

Clause	What it covers	What is worth negotiating
Capability list and quotas	Which products are enabled, and the quota or ceiling for each	Include capabilities you may need within a year, so you avoid mid-term additions
Service level agreement	The uptime target and what happens when it is missed	The trigger conditions and calculation behind service credits, not just the percentage
Support and response	Channels, response times, escalation paths, and whether a named technical contact is assigned	The contact route and owner during an incident — in the contract, not just promised verbally
Professional services and delivery	Migration, architecture review and policy tuning as deliverables	Whether go-live implementation support is included, and how often tuning continues
Term, renewal and change	Contract period, renewal mechanics and how mid-term expansion is handled	The expansion path and price adjustment mechanism for when the business grows
Compliance and data	Data handling, regional compliance and audit support	Whether the clauses your industry requires are actually covered

The process and how long it takes

1
Requirements (1–2 weeks): confirm domains, traffic baselines, target markets and the one or two problems that must be solved.
2
Design and validation (1–2 weeks): run a limited-scope test against the core problem to confirm capability boundaries and false-positive impact.
3
Quote and commercial terms (1–3 weeks): a quote against the confirmed capability mix, then contract discussion.
4
Signature and go-live (1–2 weeks): DNS cutover and policy rollout, usually domain by domain, with no downtime.

Most projects run four to eight weeks from first conversation to go-live. When there is active attack or outage pressure, a minimal emergency onboarding can come first, with the full design completed afterwards.

A checklist before you sign

The domain and subdomain list is complete, including what you plan to add this year
You have real request volume and bandwidth peak data for the last 3–6 months, not estimates
You can name the one or two most painful problems (abused endpoints, slow overseas access, a scannable origin)
You have separated mandatory capabilities from ones that can wait
You know your target markets and user distribution, and whether compliance gates apply
You can draw the current architecture: where origins sit, whether a CDN exists, whether the origin is exposed
Budget range and approval path are confirmed internally
There is a named owner on both the technical and commercial side
Any hard deadline is stated up front (a campaign or release window)
You have a rough idea of scale twelve months from now

Common mistakes

Using someone else quote as the benchmark: different capability mixes make the numbers incomparable
Asking only about price and not about boundaries: a cheaper plan missing a key module costs far more than the difference when something happens
Buying everything at once: solving the most painful problem first and expanding once it works succeeds far more often
Ignoring the tuning cost after go-live: bot management and WAF need one to two weeks of real traffic to learn, and that effort belongs in the plan
Leaving compliance to the end: licensing and qualifications for specific markets are prerequisites, not paperwork to file after launch
Assuming migration means downtime: a domain-by-domain cutover is usually invisible to users

Buying through a partner versus buying direct

Dimension	Direct	Through a Cloudflare partner
Pricing and contract terms	Set by Cloudflare pricing	Also set by Cloudflare pricing
Solution design	You select capabilities and design the architecture yourself	An architecture team familiar with overseas deployments helps scope and prioritise
Language and time zone	Official channels	Chinese-language communication, aligned hours — no 2am review calls
Implementation and migration	Self-delivered or via a separate supplier	Migration plan, phased cutover and policy tuning delivered together
After go-live	Standard support channels	Day-to-day questions come to us first; we drive escalations on your behalf
Commercial and renewal	Handled by you	Renewals, expansions and billing handled in one place

As a Cloudflare partner, our work sits outside the pricing: translating your architecture and requirements into a sensible contract, and making sure the thing actually runs once it is live.

Next step: get an assessment that fits your architecture

If you can fill in the checklist above, send it over and we will come back with a capability mix sized to your traffic and scenario, a split between what is mandatory and what is optional, and a timeline that includes implementation and tuning.

If you are not sure what you need yet, that is fine. Start from the single most painful problem today, and we will tell you whether it should be solved at this layer at all.

Frequently asked questions

How much does Cloudflare Enterprise cost per year?

There is no meaningful single number. Pricing is driven by domain count, traffic and request volume, the product mix, service commitment level and contract length — two companies of similar size can sign very different contracts. The useful question is what order of magnitude applies to you. Send us your domains, recent traffic data and capability list, and we will assess it specifically.

Can we try it before committing?

Yes. A limited-scope validation normally runs before signature: real traffic is introduced to confirm capability boundaries, false-positive rates and impact on live business, before you decide. For products with a learning period such as bot management and the WAF this step matters most — skipping it and enabling blocking immediately almost always affects real users.

Is the price different if we buy through you instead of Cloudflare directly?

Pricing and contract terms come from Cloudflare and do not change based on the channel. The difference sits outside the price: solution design and prioritisation, Chinese-language communication and time zone alignment, migration delivery and policy tuning, day-to-day contact and escalation after launch, plus renewals and expansions.

What is the shortest contract? Can we expand mid-term?

Annual contracts are the norm, and longer terms usually bring better commercial conditions. Expansion is possible, but it is worth settling the expansion path and price adjustment mechanism at signature — otherwise adding capacity after growth means a new negotiation and a worse unit price.

We already use another plan. Does upgrading mean downtime?

Usually not. Cutover is phased domain by domain: validate on a small set of domains or non-critical paths first, then widen scope, and traffic moves naturally once DNS propagates. The real thing to watch is the origin — if the origin address was previously exposed, rotate it and restrict who can reach it during migration, or edge protection can be bypassed.

What should we prepare before asking for a quote?

Five things: the domain and subdomain list including planned additions; monthly requests and bandwidth peaks for the last 3–6 months; a prioritised capability list; target markets and user distribution; and any go-live deadline. The more specific the input, the closer the quote lands to the final number. Once ready, leave a message on the contact page and we will assess it.

Want an assessment based on your own architecture?

Send us your domains, traffic volume and the problem you most want solved. We can assess it against your domain count, traffic shape and capability list.

Request an Enterprise quote